WO2022217571A1 - Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage - Google Patents

Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage Download PDF

Info

Publication number
WO2022217571A1
WO2022217571A1 PCT/CN2021/087685 CN2021087685W WO2022217571A1 WO 2022217571 A1 WO2022217571 A1 WO 2022217571A1 CN 2021087685 W CN2021087685 W CN 2021087685W WO 2022217571 A1 WO2022217571 A1 WO 2022217571A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
authentication
message
network slice
network
Prior art date
Application number
PCT/CN2021/087685
Other languages
English (en)
Chinese (zh)
Inventor
杨皓睿
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to EP21936450.2A priority Critical patent/EP4325916A4/fr
Priority to PCT/CN2021/087685 priority patent/WO2022217571A1/fr
Priority to CN202180096897.0A priority patent/CN117158012A/zh
Publication of WO2022217571A1 publication Critical patent/WO2022217571A1/fr
Priority to US18/378,830 priority patent/US20240056807A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Definitions

  • the present application relates to the field of communication technologies, and in particular, to an authentication method and apparatus, device, and storage medium for network slicing.
  • the 5th Generation mobile communication technology (5G) network has rich and diverse network services, and different network services have different requirements for the network; for example, network services such as autonomous driving and remote control require the network to have ultra-low Latency and ultra-high reliability; network services such as Augmented Reality (AR)/Virtual Reality (VR) require the network to have ultra-high bandwidth; network services such as the Internet of Things (IOT) require the network to have Support massive device access and ultra-low power saving. Therefore, in order to meet the requirements of different network services, the network is divided into multiple network slices, and different network slices are used to implement different network services.
  • network services such as autonomous driving and remote control require the network to have ultra-low Latency and ultra-high reliability
  • network services such as Augmented Reality (AR)/Virtual Reality (VR) require the network to have ultra-high bandwidth
  • network services such as the Internet of Things (IOT) require the network to have Support massive device access and ultra-low power saving. Therefore, in order to meet the requirements of different network services, the network is divided into multiple network slices,
  • NSSAA network slice-specific authentication and authorization
  • UE-to-Network relay UE-to-Network relay
  • Release 17 Release 17, R17
  • a remote terminal Remote User Equipment, RM UE
  • relay terminal Relay UE, RL UE
  • NSSAA process NSSAA process on the network slice to be used by the RM UE.
  • Embodiments of the present application provide an authentication method and apparatus, device, and storage medium for network slicing.
  • a first aspect provides an authentication method for network slicing, which is applied to a first network device, and the method includes:
  • the authentication request message In the case of receiving the authentication request message, send the first authentication message to the first terminal; the authentication request message is used to trigger the authentication process for the second terminal requesting to use the target network slice; the second The terminal accesses the first network device through the first terminal;
  • the first authentication message includes first indication information and a first Extensible Authentication Protocol (Extensible Authentication Protocol, EAP) message; the first indication information indicates that the first EAP message is used by the second terminal use; the first EAP message is used to verify the legitimacy of the second terminal using the target network slice.
  • EAP Extensible Authentication Protocol
  • an authentication method for network slicing which is applied to a first terminal, and the method includes:
  • the first authentication message includes first indication information and a first EAP message; the first indication information indicates that the first EAP message is used by the second terminal use; the first EAP information is used to verify the legitimacy of the target network slice requested by the second terminal to be used;
  • an authentication method for network slicing is provided, which is applied to a second terminal, and the method includes:
  • an authentication method for network slicing is provided, which is applied to a second terminal, and the method includes:
  • the discovery message includes the identification information of the home public land mobile network (Home Public Land Mobile Network, HPLMN) of the first terminal;
  • HPLMN Home Public Land Mobile Network
  • the HPLMN identification information of the first terminal is the same as the HPLMN identification information of the second terminal, access the first network device through the first terminal; the first network device refers to the first terminal Network equipment that provides services.
  • an authentication apparatus for network slicing which is applied to a first network device, and the apparatus includes:
  • the first sending unit is configured to send the first authentication message to the first terminal when receiving the authentication request message; the authentication request message is used to trigger the authentication of the second terminal requesting to use the target network slice; the authorization process; the second terminal accesses the first network device through the first terminal;
  • the first authentication message includes first indication information and a first EAP message; the first indication information indicates that the first EAP message is used by the second terminal; the first EAP message is used for authentication The second terminal uses the validity of the target network slice.
  • an authentication device for network slicing which is applied to a first terminal, and the device includes:
  • a second receiving unit configured to receive a first authentication message sent by a first network device; the first authentication message includes first indication information and a first EAP message; the first indication information is used to indicate the first authentication message An EAP is for the second terminal; the first EAP information is used to verify the validity of the target network slice requested by the second terminal;
  • the second sending unit is configured to send the first EAP message to the second terminal; the second terminal accesses the first network device through the first terminal.
  • an authentication device for network slicing which is applied to a second terminal, and the device includes:
  • the third receiving unit is configured to receive the first extensible authentication protocol EAP information sent by the first terminal; the first EAP information is used to verify the legitimacy of the second terminal requesting to use the target network slice; the second The terminal accesses the first network device through the first terminal.
  • an authentication device for network slicing which is applied to a second terminal, and the device includes:
  • a third receiving unit configured to receive a discovery message sent by a first terminal; the discovery message includes HPLMN identification information of the first terminal;
  • a network access unit configured to access the first network device through the first terminal if the HPLMN identification information of the first terminal is the same as the HPLMN identification information of the second terminal; the first network device is Refers to a network device that provides services for the first terminal.
  • a network device comprising: a memory, a transceiver, a processor, and a bus system;
  • the memory is used to store programs and instructions
  • the transceiver for receiving or transmitting information under the control of the processor
  • the processor is configured to execute a program in the memory
  • the bus system is used to connect the memory, the transceiver and the processor so that the memory, the transceiver and the processor communicate;
  • the processor is configured to invoke the program instructions in the memory to execute the authentication method for the network slice in the first aspect.
  • a tenth aspect provides a terminal, the terminal comprising: a memory, a transceiver, a processor, and a bus system;
  • the memory is used to store programs and instructions
  • the transceiver for receiving or transmitting information under the control of the processor
  • the processor is configured to execute a program in the memory
  • the bus system is used to connect the memory, the transceiver and the processor so that the memory, the transceiver and the processor communicate;
  • the processor is configured to invoke the program instructions in the memory to execute the method described in the second aspect, the third aspect or the fourth aspect.
  • a computer-readable storage medium on which a computer program is stored, and the computer program is executed by a processor to implement the steps of the method in the first aspect; or; the computer program is executed by the processor in the first aspect.
  • the first network device may indicate to the first terminal that the first EAP message is for the second terminal through the first indication information.
  • the first terminal can forward the first EAP message to the second terminal, so as to realize the authentication of the target network slice requested by the second terminal, ensure the security of the network slice, and solve the problem that the authentication scheme of the network slice in the prior art is not perfect. The problem.
  • FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a UE-to-Network relay architecture provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart 1 of an authentication method for a network slice provided by an embodiment of the present application
  • FIG. 4 is a second schematic flowchart of an authentication method for a network slice provided by an embodiment of the present application.
  • FIG. 5 is a third schematic flowchart of an authentication method for a network slice provided by an embodiment of the present application.
  • FIG. 6 is a fourth schematic flowchart of an authentication method for a network slice provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart 5 of an authentication method for a network slice provided by an embodiment of the present application.
  • FIG. 8 is a sixth schematic flowchart of an authentication method for a network slice provided by an embodiment of the present application.
  • FIG. 9 is a seventh schematic flowchart of an authentication method for a network slice provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram 1 of an authentication device for network slicing provided by an embodiment of the present application.
  • FIG. 11 is a second structural schematic diagram of an authentication device for network slicing provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram 3 of the structure of an authentication device for network slicing provided by an embodiment of the present application.
  • FIG. 13 is a schematic block diagram of a network device according to an embodiment of the present application.
  • FIG. 14 is a schematic block diagram of a terminal provided by an embodiment of the present application.
  • FIG. 1 exemplarily shows a schematic diagram of a system architecture provided by the present application.
  • the system architecture includes an Access and Mobility management Function (AMF) network element, a Session Management Function (SMF) network element, and a Policy Control Function (PCF). ) network element, authentication service function (AUthentication Server Function, AUSF) network element, data management function (Unified Data Management, UDM) network element, application function (Application Function, AF) network element, user plane function (User Plane Function, UPF) network element ) network element, and the Network Slice Selection Function (NSSF) network element.
  • the communication system architecture further includes a radio access network (Wireless Access Network, RAN) device, a terminal (User Equipment, UE) and a data network (Data Network, DN) network element.
  • RAN Radio access network
  • UE User Equipment
  • DN data network
  • the AMF network element is mainly used for the registration, mobility management, and tracking area update procedures of the terminal in the mobile network.
  • the mobility management network element can receive non-access stratum (Non Access Stratum, NAS) messages, complete registration management, connection management and reachability management, assign tracking area list and mobility management, etc., and transparently route session management messages to SMF network element.
  • Non-access stratum Non Access Stratum, NAS
  • the SMF network element is mainly used for session management in the mobile network, such as session creation, modification and release.
  • Specific functions include, for example, assigning Internet Protocol (IP) addresses to users, and selecting user plane network elements that provide packet forwarding functions.
  • IP Internet Protocol
  • the PCF network element includes a user subscription data management function, a policy control function, a charging policy control function, a quality of service (Quality of Service, QoS) control, and the like.
  • the AUSF network element is mainly used to use the extensible authentication protocol (EAP) to verify service functions and store keys to realize user authentication and authentication.
  • the UDM network element is mainly used to store user data, such as subscription information and authentication/authorization information.
  • UPF network element is mainly used for user plane service processing, such as service routing, packet forwarding, anchoring function, quality of service (Quality of Service, QoS) mapping and execution, uplink identification and routing to data network, downlink Packet buffering and notification triggering of downlink data arrivals, connection to external data networks, etc.
  • the NSSF network element is mainly used to select the network slice serving the UE, determine the network slice selection assistance information (Network Slice Selection Assistance Information, NSSAI) configured for the UE, and determine the NSSAI allowed by the UE.
  • NSSAI Network Slice Selection Assistance Information
  • a RAN device is a device that provides wireless communication functions for UEs.
  • Access network equipment includes but is not limited to: next-generation base stations (gNodeB, gNB), evolved Node B (evolved Node B, eNB), radio network controller (Radio Network Controller, RNC), Node B (Node B) in 5G , NB), Base Station Controller (BSC), Base Transceiver Station (BTS), Home Base Station, Base Band Unit (BBU), Transmitting and Receiving Point (TRP), Transmitting Point (TP), mobile switching center, etc.
  • next-generation base stations gNodeB, gNB
  • evolved Node B evolved Node B
  • RNC Radio Network Controller
  • Node B Node B
  • BSC Base Station Controller
  • BTS Base Transceiver Station
  • BBU Base Band Unit
  • TRP Transmitting and Receiving Point
  • TP Transmitting Point
  • the UE in this embodiment of the present application is a device with a wireless transceiver function, which can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on water; it can also be deployed in the air (for example, aircraft, balloons, etc.). and satellite, etc.).
  • UE can be mobile phone, tablet computer, computer with wireless transceiver function, VR device, AR device, wireless device in unmanned driving, wireless device in telemedicine, device in smart grid, wireless device in transportation safety, intelligent Wireless devices in cities, etc.
  • the DN network element is mainly used to provide services for users, such as operators' services, Internet access services, and third-party services.
  • the above network elements may be network elements in hardware devices, or may be software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform).
  • the above network elements may be divided into one or more services, and further, services that exist independently of network functions may also appear.
  • the UE can be connected to the AMF network element through the N1 port, and the RAN device can be connected to the AMF network element through the N2 port.
  • the UE is connected to the RAN device through the Uu port.
  • N3 is the connection between the RAN equipment and the UPF network element.
  • N4 is a connection port between the SMF network element and the UPF, and is used to transmit the control signaling between the SMF network element and the UPF network element.
  • N5 is the connection port between the PCF network element and the AF network element
  • N6 is the connection port between the UPF network element and the DN network element
  • N7 is the connection port between the SMF network element and the PCF network element
  • N8 is the AMF network element.
  • N10 is the connection port between UDM NE and SMF NE
  • N11 is the connection port between AMF NE and SMF NE
  • N12 is AUSF NE and AMF NE
  • N15 is the connection port between the AMF network element and the PCF network element
  • N22 is the connection port between the NSSF network element and the AMF network element.
  • Network slicing can be customized for different services to achieve dedicated and isolated network resources and provide better services while meeting the needs of different business scenarios.
  • the terminal may provide the requested NSSAI (ie, Requested NSSAI) to the core network.
  • the core network will make a comprehensive judgment based on the terminal's contract data, roaming agreement, and local configuration information, and return to the terminal the NSSAI allowed by the current network (ie Allowed NSSAI).
  • the terminal can establish a Packet Data Unit (PDU) session in a network slice provided by the Allowed NSSAI to transmit data.
  • PDU Packet Data Unit
  • the secondary authentication process for network slicing was introduced. That is to say, when the terminal registers with the network, in addition to performing the main authentication process of the terminal's permanent identification, it may also judge whether it is necessary to perform NSSAA on the requested network slice according to the network slice requested by the terminal and the subscription data of the terminal. , this process may also be simply referred to as the secondary authentication process of network slicing, or simply referred to as the secondary authentication process.
  • the network will trigger the NSSAA process. If the network slice authentication is successful, the network slice can be used by the terminal, and the single network slice auxiliary information (Single-Network Slice Selection Assistance Information, S-NSSAI) corresponding to the network slice is added to the Allowed NSSAI. If the network slice authentication fails, the network slice cannot be used by the terminal, and the S-NSSAI corresponding to the network slice is added to the rejected NSSAI (ie, Rejected NSSAI).
  • S-NSSAI Single-Network Slice Selection Assistance Information
  • the UE-to-Network relay architecture 200 may include an RM UE 21, an RL UE 22, a base station 23, a core network 24, and a public safety application server (AS) 25.
  • the RL UE 22 can be connected to the base station 23 through the Uu port.
  • the Uu port is the data transmission port between the UE and the base station, and is mainly used to implement functions such as broadcast paging of the base station, processing of radio resource control (Radio Resource Control, RRC) connection, handover and power control decision execution.
  • RRC Radio Resource Control
  • the RL UE 22 can also communicate with the core network 24 through the N1 port, while the base station 23 accesses the core network 24 through the N2 port. Specifically, corresponding to FIG. 1, the RL UE 22 may communicate with the AMF network element in the core network 24 through the N1 port to transmit NAS layer data.
  • the RL UE 22 may be within the coverage of the base station 23.
  • the RM UE 21 may be outside the coverage of the base station 23, and the RM UE 21 may not be directly connected to the base station 23, but directly connected to the RL UE 22 through the PC5 port, and access the core network 24 through the RL UE 22.
  • the PC5 port is a data transmission port between the UE and the UE, and the adjacent UE can establish a direct link through the PC5 port within a short range, and perform data transmission through the direct link.
  • the base station can be connected to the AS 25 via the SGi port.
  • the SGi port is used to connect with the external Internet and transmit user plane data.
  • the core network 24 can provide communication connection, authentication, management, communication, and complete bearer of data services for the RM UE 21 and the RL UE 22.
  • the core network is divided into a user plane function and a control plane function.
  • the user plane function is mainly responsible for packet forwarding and QoS control.
  • the control plane function is mainly responsible for user registration and authentication, mobility management, delivery of data packet forwarding policies to UPF network elements, or QoS control policies.
  • the functions of the control plane mainly include AMF network elements and SMF network elements.
  • the RM UE 21 can access the network through the RL UE 22 to implement data transmission. If the network slice requested by the terminal needs to perform NSSAA, although the existing NSSAA process can be used for the RL UE 22, it is unclear whether the network slice can be used for the authentication of the RM UE 21.
  • the embodiments of the present application provide an authentication method for network slicing, which can solve the problem that the authentication solution for network slicing in the related art is not perfect.
  • FIG. 3 is a schematic flowchart of an authentication method for a network slice provided by an embodiment of the present application. As shown in FIG. 3 , the authentication method for a network slice provided by this embodiment of the present application may include steps 301 to 304 .
  • Step 301 In the case of receiving the authentication request message, the first network device sends a first authentication message to the first terminal.
  • the first authentication message includes first indication information and a first EAP message; the first indication information indicates that the first EAP message is used by the second terminal.
  • Step 302 The first terminal receives the first authentication message sent by the first network device.
  • Step 303 The first terminal sends a first EAP message to the second terminal.
  • Step 304 the second terminal receives the first EAP message.
  • the first network device may be an AMF network element in the core network, and is used to perform network registration, mobility management, tracking area update, terminal paging and the like for the first terminal and the second terminal.
  • the second terminal may access the first network device through the first terminal. That is, the first terminal may provide a relay service for the second terminal and the first network device, and forward data for the second terminal and the first network device. It can be understood that the first terminal is the RL UE 22 in the UE-to-Network relay architecture 200 shown in FIG. 2 . The second terminal may be the RM UE 21 in the UE-to-Network relay architecture 200.
  • the second terminal may determine that the target network slice needs to be used according to the current service. If the target network slice requires slice granularity authentication and authorization, that is, the target network slice is a network slice that requires NSSAA, the second terminal may trigger an authentication process for the target network slice.
  • the second terminal may send an authentication request message.
  • the authentication request message is used to trigger an authentication process for the second terminal that requests to use the target network slice. That is, the second terminal triggers the authentication process of the target network slice requested to be used by the network side through the authentication request message.
  • the second terminal may send an authentication request message to the first terminal, so that the first terminal forwards the authentication request message to the first network device, thereby triggering the authentication process of the target network slice on the network side.
  • the second terminal may send an authentication request message to the first terminal through the PC5 port.
  • the first terminal can send the authentication request message to the first network device through the N1 port, or the first terminal can also send the authentication request message to the base station through the Uu port, and then the base station uses the N2 port to authenticate the request message.
  • the request message is sent to the first network device.
  • the second terminal may notify the first authentication, authorization and accounting server (Authentication Authorization Accounting-Server, AAA-S) through the application layer to authenticate the target network slice to be used.
  • the first AAA-S is the home AAA-S of the second terminal. Based on this, the home AAA-S corresponding to the second terminal may send an authentication request message to the first network device, so as to trigger the authentication process of the target network slice on the network side.
  • the system architecture shown in FIG. 1 may further include a network slice authentication and authorization function (NSSAA Function, NSSAAF) network element.
  • NSSAA Function NSSAAF
  • the first AAA-S may be connected to the NSSAAF network element, and send an authentication request message to the first network device through the NSSAAF network element.
  • the network side can also verify whether the data transmitted by the first AAA-S is credible data through the authentication, authorization and accounting proxy (AAA-P) network element.
  • the AAA-P network element is arranged between the first AAA-S and the NSSAAF network element, and is used for verifying the data sent by the first AAA-S. It can be understood that the first AAA-S can send an authentication request message to the AAA-P network element. If the AAA-P network element verifies the authentication request message successfully, the AAA-P network element sends the authentication request message through the NSSAA. forwarded to the first network device in the core network.
  • the target network slice may require periodic authentication. Based on this, the first AAA-S may actively send an authentication request message to the first network device according to the time period, so as to trigger the authentication process for the target network slice.
  • the authentication request message received by the first network device may come from the first terminal or the first AAA-S.
  • the authentication request message may include at least one of the following information: identification information of the second terminal, S-NSSAI corresponding to the target network slice, and the home public land mobile network (Home) of the second terminal.
  • Public Land Mobile Network, HPLMN Public Land Mobile Network
  • the identification information of the second terminal can be an International Mobile Subscriber Identity (IMSI), a globally unique temporary UE identity (Globally Unique Temporary UE Identity, GUTI), and a Global Positioning System Identity (Global Positioning System Identity, GPSI).
  • IMSI International Mobile Subscriber Identity
  • GUTI Globally Unique Temporary UE Identity
  • GPSI Global Positioning System Identity
  • the IMSI may carry the HPLMN identification information of the second terminal at the same time, while the GUTI and GPSI do not contain the HPLMN identification information of the second terminal. Therefore, when the IMSI is used, the authentication request message may not separately carry the HPLMN identification information of the second terminal.
  • the first network device may start the process of authenticating the target network slice requested by the second terminal based on the received authentication request message.
  • the authentication process initiated by the first network may be an EAP Protected Extensible Authentication Protocol (EAP-PEAP) authentication process, or an EAP Message Digest Algorithm (EAP-Message Digest 5, EAP-MD5) authentication process, or It may be an EAP-Transport Level Security (EAP-Transport Level Security, EAP-TLS) authentication process, which is not limited in this embodiment of the present application.
  • the first network device may send the first authentication message to the first terminal.
  • the first authentication message may include the first indication information and the first EAP message.
  • the first EAP message is used to verify the legitimacy of the second terminal using the target network slice; the first indication information may indicate that the first EAP message is used by the second terminal.
  • the first indication information may indicate that the first EAP message is directed to the second terminal.
  • the first terminal can parse the first authentication message to obtain the first indication information and the first EAP message. Further, the first terminal may send the first EAP message to the second terminal according to the first indication information in the first authentication message.
  • the first indication information may include identification information of the second terminal and/or S-NSSAI of the target network slice. That is, the first network device indicates that the first EAP message is for the second terminal through the identification information of the second terminal and/or the S-NSSAI of the target network slice.
  • the identification information of the second terminal is the same as that in the foregoing embodiment, and details are not described herein again.
  • the first EAP message may include authentication-related information of the second terminal requesting to use the target network slice.
  • the first EAP message may include an encryption algorithm, certificate information of the first AAA-S (including name information and public key information of the first AAA-S), random encryption information, and the like.
  • the second terminal may authenticate the target network slice based on the authentication-related information in the first EAP message.
  • the first network device can indicate to the first terminal that the first EAP message is for the second terminal through the first indication information.
  • the first terminal can forward the first EAP message to the second terminal, so as to realize the authentication of the target network slice requested by the second terminal, ensure the security of the network slice, and solve the problem that the authentication scheme of the network slice in the prior art is not perfect. The problem.
  • the target network slice in this embodiment of the present application is a network slice that needs to perform NSSAA.
  • NSSAA network slicing needs to be performed, which is usually deployed at the home location of the terminal and bound to the HPLMN of the terminal. That is to say, the authentication of the target network slice needs to be performed through the NSSAAF network element at the home of the second terminal and/or the AAA-S at the home of the second terminal.
  • the second terminal performs relay communication through the first terminal, and the data transmission of the second terminal uses the resources of the first terminal. Therefore, in order to authenticate the target network slice requested by the second terminal, the HPLMNs of the second terminal and the first terminal need to be the same. Based on this, the second terminal may use the home NSSAAF of the first terminal and/or the home AAA-S to authenticate the target network slice.
  • steps 305 to 307 may also be implemented before step 301 .
  • Step 305 The first terminal sends a discovery message; the discovery message includes the HPLMN identification information of the first terminal.
  • Step 306 The second terminal receives the discovery message sent by the first terminal.
  • Step 307 If the HPLMN identification information of the first terminal is the same as the HPLMN identification information of the second terminal, the second terminal accesses the first network device through the first terminal; the first network device refers to the one that currently provides services for the first terminal. Network equipment.
  • a discovery message may be broadcast to the outside world.
  • the discovery message may carry the HPLMN identification information of the first terminal, so as to inform the surrounding terminals that it can provide the relay service.
  • the second terminal may be a terminal without network coverage, or a low-cost and/or low-bandwidth terminal that cannot directly access the network.
  • the second terminal is located adjacent to the first terminal, and the second terminal may receive the discovery message sent by the first terminal. Further, the second terminal may determine the target network slice to be used according to the current service. If the target network slicing needs to perform NSSAA, the second terminal may judge whether the HPLMN of the first terminal and its own are the same according to the HPLMN identification information of the first terminal carried in the discovery message.
  • the second terminal may also actively initiate short-range communication. Specifically, when the second terminal wishes to use the target network slice for data transmission, it may actively broadcast a discovery request message before step 305 to request terminals around the second terminal to provide relay services.
  • the discovery request message may include the HPLMN of the second terminal and/or the S-NSSAI of the requested target network slice.
  • the first terminal may feed back a discovery response message (ie, the discovery message in step 305 ) to the second terminal based on the foregoing discovery request message.
  • the discovery response message carries the HPLMN identification information of the first terminal.
  • the second terminal can determine whether the HPLMN of the first terminal and its own are the same according to the discovery message sent by the first terminal.
  • the second terminal selects the first terminal, and establishes a short-range communication connection with the first terminal.
  • the requested target network slice is authenticated by accessing the first network device through the first terminal.
  • the reason why the second terminal selects the first terminal with the same HPLMN to authenticate the target network slice is that the target network slice for which NSSAA needs to be performed is bound to the home operator of the second terminal. Therefore, only Only when the HPLMN identification information of the first terminal and the second terminal are the same can the target network slice be authenticated and used.
  • the discovery message may also carry an NSSAI supported by the first terminal, or a relay service code (Relay Service Code, RSC) corresponding to each S-NSSAI in the NSSAI.
  • RSC relay Service Code
  • the NSSAI supported by the first terminal includes the S-NSSAI corresponding to the target network slice.
  • the second terminal can determine whether to use the first terminal as a relay terminal according to the NSSAI carried in the discovery message or the RSC corresponding to each S-NSSAI in the NSSAI, and the HPLMN identification information.
  • the second terminal is the same as the second terminal.
  • a terminal establishes a short-range communication connection.
  • the NSSAI supported by the first terminal may be at least one of the NSSAI subscribed by the first terminal, the NSSAI subscribed by the first terminal (that is, the Subscribed NSSAI), and the NSSAI (that is, the Configured NSSAI) configured by the network for the first terminal.
  • the NSSAI supported by the first terminal not only includes the S-NSSAI in the Allowed NSSAI of the first terminal, but also may include the S-NSSAI in the Rejected NSSAI. This is because the network slice expected to be used by other terminals using the first terminal for relay communication is not necessarily in the Allowed NSSAI. Therefore, the first terminal may carry the S-NSSAI corresponding to all supported network slices in the discovery message for broadcasting.
  • steps 301 to 304 may be performed during the process of establishing short-distance communication between the first terminal and the second terminal, or may be performed after the first terminal and the second terminal establish short-distance communication.
  • the first terminal may carry HPLMN identification information in the discovery message to establish short-range communication with the adjacent second terminal, so as to provide information for the adjacent second terminal.
  • the terminal forwards the authentication-related information for the target network slice to realize the authentication of the target network slice and ensure the security of the slice.
  • the authentication method for network slicing provided by the implementation of this application may further include steps 308 to 312 .
  • Step 308 The second terminal sends a second EAP message to the first terminal; the second EAP message is used to verify the legitimacy of the second terminal using the target network slice.
  • the second terminal may authenticate the first AAA-S based on the authentication-related information carried in the first EAP message. After the verification is successful, the second terminal may generate a second EAP message based on the first EAP message.
  • the second EAP message may carry the authentication-related information of the second terminal, which is used to verify the legitimacy of the second terminal using the target network slice.
  • the second EAP message may include information such as encryption information encrypted by using the public key, certificate information of the second terminal, and the like.
  • the second terminal may send the second EAP message to the first terminal through the PC5 port.
  • Step 309 the first terminal receives the second EAP message.
  • the first terminal may receive the second EAP message through the PC5 port.
  • Step 310 The first terminal sends a second authentication message to the first network device; the second authentication message includes second indication information and a second EAP message; the second indication information is used to indicate that the second EAP message and the first Two terminal associations.
  • the first terminal may determine that the second EAP message is used to authenticate the second terminal that requests the target network slice. Based on this, the first terminal may generate second indication information, and use the second indication information to indicate that the second EAP message is directed to the second terminal.
  • the second indication information may include identification information of the second terminal and/or the S-NSSAI of the target network slice. That is, the first network device indicates through the identification information of the second terminal and/or the S-NSSAI of the target network slice that the second EAP message is associated with the second terminal, that is, the second EAP message is directed to the second terminal .
  • the first terminal can generate the second authentication message according to the second indication information and the second EAP message, and send the second authentication message to the first network device.
  • Step 311 The first network device receives the second authentication message.
  • Step 312 The first network device sends a second authentication message to the first AAA-S.
  • the first network device after receiving the second authentication message, the first network device sends the second authentication message to the home AAA-S corresponding to the second terminal, that is, the first AAA-S. So that the first AAA-S authenticates the target network slice requested by the second terminal based on the second EAP message.
  • the first AAA-S may verify the right of the second terminal to use the target network slice based on the second EAP message, obtain an authentication result, and feed back the authentication result to the first network device.
  • the first network device can send the authentication result to the first terminal, so that the first terminal can perform subsequent relay services.
  • steps 301 to 304, and steps 308 to 312 may be performed multiple times. That is, the first EAP message and the second EAP message may be repeatedly exchanged between the first terminal, the second terminal, the first network device, and the first AAA-S for many times until the verification succeeds or the expiration times are reached.
  • the first terminal is responsible for forwarding the EAP message between the first network device and the second terminal, and indicates through the indication information that the EAP message is with the second terminal. Accordingly, in this way, the authentication of the target network slice requested by the second terminal is realized, and the security of the network slice is guaranteed.
  • steps 313 to 321 may also be performed.
  • Step 313 The first network device sends an authentication command to the first terminal based on the authentication request message; the authentication command includes the EAP identification request message and the third indication information; the third indication information indicates that the EAP identification request message is used by the second terminal. terminal use.
  • the first network device After the first network device starts the authentication process for the target network slice used by the second terminal, it can send an authentication command to the first terminal.
  • the EAP identification request message in the authentication command may be used to request user identity information of the second terminal, so as to authenticate the identity of the second terminal based on the user identity information of the second terminal.
  • the authentication command further needs to carry third indication information.
  • the third indication information may include the identification information of the second terminal and/or the S-NSSAI of the target network slice. That is, the first network device indicates through the identification information of the second terminal and/or the S-NSSAI of the target network slice that the EAP identification request message is associated with the second terminal, that is, the EAP identification request message is directed to the second terminal of.
  • the first network device prompts the first terminal through the third indication information that the EAP identification request message in the authentication command is sent to the second terminal.
  • Step 314 The first terminal receives the authentication command sent by the first network device.
  • the first terminal may receive the authentication command through the NAS layer, and obtain the third indication information and the EAP identification request message by parsing.
  • Step 315 The first terminal sends an EAP identification request message to the second terminal.
  • the first terminal may send the EAP identification request message to the second terminal through the PC5 port based on the third indication information.
  • Step 316 secondly receive the EAP identification request message sent by the first terminal
  • Step 317 The second terminal sends an EAP identification response message to the first terminal.
  • the second terminal may forward the EAP identification request message to its own EAP protocol layer, and process the EAP identification request message through the EAP protocol layer to obtain the EAP identification response message.
  • the EAP identification response message is used to carry the authentication information of the second terminal, so as to realize the authentication of the target network slice requested by the second terminal on the network side.
  • the second terminal may send the EAP identification response message to the first terminal through the PC5 port.
  • Step 318 The first terminal receives the EAP identification response message sent by the second terminal.
  • Step 319 The first terminal sends an authentication command response message to the first network device; the authentication command response message includes fourth indication information and an EAP identification response message; the fourth indication information is used to indicate that the EAP identification response message is associated with the second terminal .
  • the first terminal may forward the EAP indication response message to the first network device.
  • the first terminal may simultaneously send fourth indication information, and the fourth indication information indicates that the EAP identification response message is associated with the second terminal, that is, the EAP identification response message is directed to the second terminal.
  • Step 320 The first network device receives the authentication command response message sent by the first terminal.
  • Step 321 The first network device sends an authentication command response message to the first AAA-S.
  • the first network device forwards the authentication command response message to the first AAA-S, and the first AAA-S verifies the user identity information of the second terminal, thereby realizing Authentication of the target network slice to ensure the security of the slice.
  • Step 304 After the first network device sends the first authentication message to the first terminal, steps 322 to 326 may also be performed.
  • Step 322 The first network device receives the authentication result message sent by the first AAA-S; the authentication result message includes the authentication result of the target network slice requested by the second terminal.
  • the first AAA-S authenticates the validity of the target network slice used by the second terminal to obtain an authentication result.
  • the first AAA-S may notify the first network device of the target network slice authentication result requested by the second terminal.
  • the authentication result message carries the authentication result of the target network slice, and also carries the identification information of the second terminal and/or the S-NSSAI of the target network slice to indicate the authentication result is the target network slice requested by the second terminal.
  • Step 323 The first network device sends an authentication result message to the first terminal.
  • the first network device may send an authentication result message to the first terminal to notify the first terminal of the authentication result of the target network slice requested by the second terminal.
  • Step 324 The first terminal receives the authentication result message sent by the first network device.
  • Step 325 If the authentication result indicates that the authentication of the target network slice requested by the second terminal is successful, the first terminal relays the data in the target network slice for the second terminal.
  • the first terminal may determine whether the authentication of the target network slice requested by the second terminal is successful.
  • the first terminal may determine that the network side has allowed the second terminal to use the target network slice. In this way, the first terminal can relay the service data in the target network slice for the second terminal.
  • the first terminal determines that the network side does not allow the second terminal to use the target network slice. In this way, the first terminal refuses to relay the service data in the target network slice for the second terminal.
  • the network slice authentication method provided in this embodiment of the present application may further include the following steps:
  • Step 326 The first terminal sends the authentication result of the target network slice to the second terminal.
  • the first terminal may send the authentication result of the target network slice requested by the second terminal to the second terminal based on the identification information of the second terminal in the authentication result message.
  • the second terminal can perform subsequent service processing based on the authentication result.
  • the second terminal stops transmitting service data through the target network slice. If the authentication of the target network slice requested by the second terminal succeeds, the second terminal transmits the data of the target network slice through the first terminal.
  • the authentication method for network slice provided by the embodiment of the present application may include the following steps:
  • Step 801 the second terminal receives the discovery message sent by the first terminal; the discovery message includes the HPLMN identification information of the first terminal;
  • Step 802 If the HPLMN identification information of the first terminal is the same as the HPLMN identification information of the second terminal, the second terminal accesses the first network device through the first terminal; the first network device refers to a network that provides services for the first terminal. equipment.
  • the second terminal is located adjacent to the first terminal, and the second terminal can receive the discovery message sent by the first terminal. Further, the second terminal may determine the target network slice to be used according to the current service. If the target network slicing needs to perform NSSAA, the second terminal may judge whether the HPLMN of the first terminal and its own are the same according to the HPLMN identification information of the first terminal carried in the discovery message.
  • the second terminal may also actively initiate short-range communication.
  • the second terminal may also perform the following steps:
  • the discovery request message is used to request the surrounding terminals to provide relay services.
  • the discovery request message may include the HPLMN of the second terminal and/or the S-NSSAI of the requested target network slice.
  • the second terminal when the second terminal expects to use the target network slice, it can actively initiate short-range communication, and use the target network slice for data transmission through the relay service provided by other terminals.
  • the first terminal may feed back a discovery response message (that is, the discovery message in step 801 ) to the second terminal based on the foregoing discovery request message, and the discovery response message carries the discovery response message.
  • a discovery response message that is, the discovery message in step 801
  • the discovery response message carries the discovery response message.
  • HPLMN identification information of the first terminal In this way, after receiving the discovery message sent by the first terminal, the second terminal can determine whether the HPLMN of the first terminal and its own are the same according to the discovery message sent by the first terminal.
  • the second terminal selects the first terminal, and establishes a short-range communication connection with the first terminal. In this way, the second terminal can access the first network device through the first terminal, so as to trigger the network side to authenticate the target network slice requested by the second terminal.
  • the discovery message may also carry an NSSAI supported by the first terminal, or a relay service code (Relay Service Code, RSC) corresponding to each S-NSSAI in the NSSAI.
  • RSC relay Service Code
  • the NSSAI supported by the first terminal includes the S-NSSAI corresponding to the target network slice.
  • the second terminal can determine whether to use the first terminal as a relay terminal according to the NSSAI carried in the discovery message or the RSC corresponding to each S-NSSAI in the NSSAI, and the HPLMN identification information.
  • the second terminal is the same as the second terminal.
  • a terminal establishes a short-range communication connection.
  • the NSSAI supported by the first terminal may be the S-NSSAI subscribed by the first terminal, the NSSAI subscribed by the first terminal (that is, Subscribed NSSAI), and the NSSAI (that is, Configured NSSAI) configured by the network for the first terminal. at least one of. That is to say, the NSSAI supported by the first terminal not only includes the S-NSSAI in the Allowed NSSAI of the first terminal, but also may include the S-NSSAI in the Rejected NSSAI. This is because the network slice expected to be used by other terminals using the first terminal for relay communication is not necessarily in the Allowed NSSAI. Therefore, the first terminal may carry the S-NSSAI corresponding to all supported network slices in the discovery message for broadcasting.
  • the first terminal may carry HPLMN identification information in the discovery message to establish short-range communication with the adjacent second terminal, so as to provide information for the adjacent second terminal.
  • the terminal forwards the authentication-related information for the target network slice to realize the authentication of the target network slice and ensure the security of the slice.
  • the authentication method for network slicing provided by the embodiment of the present application is described in detail below with reference to an actual application scenario.
  • the network slice authentication method provided by this embodiment of the present application may include the following steps:
  • Step 1 The RL UE sends a discovery message.
  • the RL UE is the first terminal in the above embodiment, and can provide relay services for other terminals.
  • the discovery message includes the HPLMN identification information of the first terminal, that is, the HPLMN ID.
  • the discovery message may further include the NSSAI supported by the RL UE or the RSC corresponding to each S-NSSAI in the NSSAI.
  • the NSSAI supported by the RL UE, or the S-NSSAI associated with the RSC may include the NSSAI subscribed by the RL UE, the Subscribed NSSAI of the RL UE, and all the S-NSSAIs in the Configured NSSAI of the RL UE whose network is the RL UE.
  • the NSSAI supported by the RL UE, or the S-NSSAI associated with the RSC may be included in the S-NSSAI in the Rejected NSSAI.
  • the NSSAI supported by the RL UE, or the S-NSSAI associated with the RSC may be the S-NSSAI subscribed by the RL UE. That is, the number of NSSAIs supported by the RL UE, or S-NSSAIs associated with the RSC is greater than or equal to the number in the Allowed NSSAIs. This is because the network slice requested by the UE using the RL UE for relay transmission is not necessarily in the Allowed NSSAI.
  • Step 2 After the RM UE receives the discovery message, it checks whether the RL UE is the same as its own HPLMN. If the HPLMN of the RL UE and the RM UE is the same, the RL UE is selected.
  • the RM UE is the second terminal in the above embodiment.
  • the RM UE determines to use the target network slice according to the current service.
  • the second terminal may receive the discovery message, so as to access the network through other UEs, so as to realize the authentication of the target network slice.
  • Step 3 The RM UE establishes a short-range communication connection with the RL UE.
  • the RM UE establishes a short-range communication connection with the RL UE based on the discovery message. In this way, the RM UE can access the network through the RL UE, and communicate with the network side through the RL UE corresponding to the AMF network element.
  • Step 4 Trigger the RL-AMF to perform the NSSAA authentication process on the target network slice.
  • the RL-AMF is the first network device in the foregoing embodiment.
  • the RL-AMF may be the AMF network element currently serving the RL UE.
  • the RL-AMF is triggered to execute the NSSAA process of the target network slice, and the trigger operation may come from the RL UE or the RM-AAA-S.
  • the RM-AAA-S is the first AAA-S in the above-mentioned embodiment, which is deployed in the home of the RM UE.
  • step 4 may be implemented by step 4a.
  • Step 4a the RM UE sends an authentication request message to the RL UE, and the RL UE forwards the authentication request message to the RL-AMF to trigger the RL-AMF to authenticate the target network slice used by the RM UE.
  • the authentication request message includes the S-NSSAI of the requested target network slice, the HPLMN ID of the RM UE, and the identification information of the RM UE.
  • step 4 may also be implemented through step 4b.
  • Step 4b the RM-AAA-S sends an authentication request message to the RL-AMF to trigger the RL-AMF to authenticate the target network slice used by the RM UE.
  • the RM UE can trigger the RM-AAA-S to perform NSSAA through the application layer.
  • Step 5 The RL-AMF sends an authentication command (NSSAA command) to the RL UE.
  • NSSAA command an authentication command
  • the authentication command includes an EAP ID request message (EAP ID request) that needs to be sent to the RM UE.
  • EAP ID request EAP ID request message
  • the authentication command also includes the S-NSSAI of the target network slice and the identification information of the RM UE to indicate to the RL UE that the EAP identification request message is sent to the RM UE.
  • Step 6 The RL UE sends the received EAP ID request message (EAP ID request) and the S-NSSAI of the target network slice to the RM UE.
  • EAP ID request EAP ID request
  • S-NSSAI S-NSSAI
  • the NAS layer of the RL UE after receiving the authentication command (NSSAA command), the NAS layer of the RL UE sends the EAP ID request message (EAP ID request) and the S-NSSAI of the target network slice to its own PC5 layer. Send the EAP ID request message (EAP ID request) and the S-NSSAI of the target network slice to the RM UE through the PC5 port.
  • EAP ID request EAP ID request
  • S-NSSAI of the target network slice to its own PC5 layer.
  • Step 7 After receiving the EAP ID request message (EAP ID request) and the S-NSSAI of the target network slice, the RM UE generates an EAP ID response message, and sends the EAP ID response message and the S-NSSAI of the target network slice to the RL UE .
  • EAP ID request EAP ID request
  • S-NSSAI S-NSSAI
  • the RM UE transfers the EAP identification request message to its own EAP protocol layer, and obtains the EAP identification response message through the EAP protocol layer processing.
  • Step 8 The RL UE sends an authentication command response message to the RL AMF.
  • the authentication command response message includes the EAP identification response message, the S-NSSAI of the target network slice, and the identification information of the RM UE.
  • the RL UE indicates that the EAP identification response message is for the RM UE by carrying the identification information of the RM UE in the authentication command response message.
  • Step 9 RL-AMF, RM-AAA-S, RL UE, and RM UE transmit EAP messages to authenticate the validity of RM UE using the target network slice, and RM-AAA-S notifies RL-AMF for RM The UE uses the authentication result of the target network slice.
  • the EAP message refers to carrying information related to RM UE authentication, such as certificate information, key information, and the like.
  • the EAP message here includes the first EAP message and/or the second EAP message in the above embodiments.
  • the NSSAAF network element of the RM UE also participates in the authentication process, which is not shown in FIG. 9 .
  • the RL UE is responsible for forwarding the EAP message between the RL-AMF and the RM UE, and the signaling between the AMF and the RL UE needs to include the RM UE ID and the RM HPLMN S-NSSAI to indicate the EAP message is for RM.
  • Step 10 the RL-AMF sends an authentication result message to the RL UE.
  • the authentication result message includes the authentication result of the target network slice, and also includes the identification information of the RM UE and the HPLMN identification information of the RM UE, to indicate that the authentication result of the target network slice is for the RM UE.
  • the RL UE can determine whether the network side allows the RM UE to use the target network slice. If the network side allows the RM UE to use the target network slice, the RL UE can relay the service data in the target network slice for the RM UE.
  • An embodiment of the present application provides an authentication apparatus for network slicing, and the apparatus can be applied to the first network device provided in the above embodiment.
  • the authentication apparatus 100 for network slicing provided in this embodiment of the present application is Can include:
  • the first sending unit 1001 is configured to send a first authentication message to the first terminal in the case of receiving an authentication request message; the authentication request message is used to trigger an authentication request to a second terminal requesting to use the target network slice. an authentication process; the second terminal accesses the first network device through the first terminal;
  • the first authentication message includes first indication information and a first EAP message; the first indication information indicates that the first EAP message is used by the second terminal; the first EAP message is used for authentication The second terminal uses the validity of the target network slice.
  • the HPLMN of the first terminal and the second terminal are the same.
  • the authentication request message comes from the first terminal or the first AAA-S; the first AAA-S is the home AAA-S of the second terminal.
  • the authentication request message includes at least one of the following information: identification information of the second terminal, single network slice auxiliary information corresponding to the target network slice, and HPLMN of the second terminal identification information.
  • the authentication apparatus 100 for network slicing may further include a first receiving unit.
  • the first receiving unit configured to receive the second authentication message sent by the first terminal
  • the first sending unit 1001 is further configured to send the second authentication message to the first AAA-S;
  • the second authentication message includes second indication information and a second EAP message; the second indication information indicates that the second EAP message is associated with the second terminal; the second EAP message is used for Verifying the legitimacy of using the target network slice by the second terminal.
  • the first sending unit 1001 is further configured to send an authentication command to the first terminal based on the authentication request message;
  • the authentication command includes an EAP identification request message and third indication information;
  • the third indication information indicates that the EAP identification request message is used by the second terminal;
  • the first receiving unit is further configured to receive an authentication command response message sent by the first terminal; the authentication command response message includes fourth indication information and an EAP identification response message; the fourth indication information indicates the EAP An identification response message is associated with the second terminal.
  • the first receiving unit is further configured to receive an authentication result message sent by the first AAA-S; the authentication result message includes the authentication of the target network slice requested by the second terminal result;
  • the first sending unit 1001 is configured to send the authentication result message to the first terminal.
  • An embodiment of the present application further provides an authentication apparatus for network slicing, and the apparatus can be applied to the first terminal provided in the above-mentioned embodiment.
  • the authentication apparatus 110 for network slicing provided in this embodiment of the present application is Can include:
  • the second receiving unit 1101 is configured to receive a first authentication message sent by a first network device; the first authentication message includes first indication information and a first EAP message; the first indication information indicates the first authentication message
  • the EAP message is used by the second terminal; the first EAP message is used to verify the validity of the target network slice requested by the second terminal to be used;
  • the second sending unit 1102 is configured to send the first EAP message to the second terminal; the second terminal accesses the first network device through the first terminal.
  • the HPLMN of the first terminal and the second terminal are the same.
  • the second sending unit 1102 is configured to send an authentication request message to the first network device; the authentication request message is used to trigger an authentication process for the second terminal requesting to use the target network slice .
  • the authentication request message includes at least one of the following information: identification information of the second terminal, single network slice auxiliary information corresponding to the target network slice, and HPLMN of the second terminal identification information.
  • the second receiving unit 1101 is configured to receive a second EAP message sent by a second terminal; the second EAP message is used to verify the legitimacy of the second terminal using the target network slice;
  • a second sending unit configured to send a second authentication message to the first network device
  • the second authentication message includes second indication information and a second EAP message; the second indication information indicates that the second EAP message is associated with the second terminal.
  • the second receiving unit 1101 is configured to receive an authentication command sent by the first network device; the authentication command includes an EAP identification request message and third indication information; the third indication information indicates the EAP identification request message is used by the second terminal;
  • the second sending unit 1102 is configured to send the EAP identification request message to the second terminal.
  • the second receiving unit 1101 is configured to receive an EAP identification response message sent by the second terminal;
  • the second sending unit 1102 is further configured to send an authentication command response message to the first network device; the authentication command response message includes fourth indication information and the EAP identification response message; the fourth indication information indicates The EAP identification response message is associated with the second terminal.
  • the second receiving unit 1101 is further configured to receive an authentication result message sent by the first network device; the authentication result message includes the target network slice requested by the second terminal. Authentication result;
  • the authentication device 110 for the network slice may further include a processing unit, and the processing unit may cooperate so that if the authentication result indicates that the authentication of the target network slice requested by the second terminal is successful, then the authentication of the target network slice requested by the second terminal is successful.
  • the second terminal relays the data in the target network slice.
  • the second sending unit is further configured to send a discovery message; the discovery message includes HPLMN identification information of the first terminal.
  • An embodiment of the present application further provides an authentication apparatus for network slicing, and the apparatus can be applied to the second terminal provided in the foregoing embodiment.
  • the authentication apparatus 120 for network slicing provided in this embodiment of the present application Can include:
  • the third receiving unit 1201 is configured to receive a first EAP message sent by a first terminal; the first EAP message is used to verify the legitimacy of a request by the second terminal to use a target network slice; the second terminal passes the The first terminal accesses the first network device.
  • the HPLMN of the first terminal and the second terminal are the same.
  • the authentication apparatus 120 for the above network slicing may further include a third sending unit; the third sending unit is configured to send an authentication request message; the authentication request message is used to trigger the request to use the the authentication process of the second terminal of the target network slice.
  • the third sending unit is configured to send the authentication request message to the first terminal through the PC5 port; or send the authentication request message to the first AAA-S through the application layer; the first An AAA-S is the home AAA-S of the second terminal.
  • the authentication request message includes at least one of the following information: identification information of the second terminal, single network slice auxiliary information corresponding to the target network slice, and information of the second terminal HPLMN identification information.
  • the third sending unit is further configured to send a second EAP message to the first terminal; the second EAP message is used to perform the second EAP message on the second terminal using the target network slice and the validity. Authentication.
  • the third receiving unit 1201 is configured to receive an EAP identification request message sent by the first terminal;
  • the third sending unit is further configured to send an EAP identification response message to the first terminal.
  • the third receiving unit 1201 is further configured to receive a discovery message sent by the first terminal; the discovery message includes HPLMN identification information of the first terminal.
  • the authentication apparatus 120 for network slicing may further include a network access unit 1202, configured to be configured so that if the HPLMN identification information of the first terminal is the same as that of the second terminal If the HPLMN identification information is the same, the first network device is accessed through the first terminal.
  • a network access unit 1202 configured to be configured so that if the HPLMN identification information of the first terminal is the same as that of the second terminal If the HPLMN identification information is the same, the first network device is accessed through the first terminal.
  • the embodiment of the present application further provides an authentication device for network slicing, and the device can be applied to the second terminal provided in the foregoing embodiment.
  • the authentication device 120 may include:
  • the third receiving unit 1201 is configured to receive a discovery message sent by a first terminal; the discovery message includes HPLMN identification information of the first terminal;
  • the network access unit 1202 is configured to access the first network device through the first terminal if the HPLMN identification information of the first terminal is the same as the HPLMN identification information of the second terminal; the first network device Refers to a network device that provides services for the first terminal.
  • each functional unit in the above-mentioned embodiment may be integrated into one processing module, or each unit may exist physically alone, or two or more units may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules.
  • the integrated modules are implemented in the form of software function modules and are not sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of this embodiment is essentially or correct. Part of the contribution made by the prior art or all or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium, and includes several instructions to make a computer device (which can be a personal A computer, a server, or a network device, etc.) or a processor (processor) executes all or part of the steps of the method in this embodiment.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read only memory (Read Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes.
  • an embodiment of the present application further provides a network device.
  • the network device provided by the embodiment of the present application may include a memory 1301 , a transceiver 1302 , a processor 1303 , and a bus system 1304 .
  • the memory 1301 is used to store programs and instructions
  • the transceiver 1302 is used to receive or transmit information under the control of the processor 1303;
  • the processor 1303 is used for executing the program in the memory 1301;
  • the bus system 1301 is used to connect the memory 1301, the transceiver 1302 and the processor 1303, so that the memory 1301, the transceiver 1302 and the processor 1303 communicate;
  • the processor 1303 is configured to call program instructions in the memory 1301, and control the transceiver 1302 to perform the following steps:
  • the authentication request message In the case of receiving the authentication request message, send the first authentication message to the first terminal; the authentication request message is used to trigger the authentication process for the second terminal requesting to use the target network slice; the second The terminal accesses the first network device through the first terminal;
  • the first authentication message includes first indication information and a first Extensible Authentication Protocol EAP message; the first indication information indicates that the first EAP message is used by the second terminal; the first The EAP message is used to verify the legitimacy of the second terminal using the target network slice.
  • the processor 1303 may also be configured to invoke program instructions in the memory 1301 to control the transceiver 1302 to perform the following steps:
  • the second authentication message includes second indication information and a second EAP message; the second indication information indicates that the second EAP message is associated with the second terminal; the second EAP message is used for Verifying the legitimacy of using the target network slice by the second terminal.
  • the processor 1303 may also be configured to invoke program instructions in the memory 1301 to control the transceiver 1302 to perform the following steps:
  • an authentication command is sent to the first terminal;
  • the authentication command includes an EAP identity request message and third indication information;
  • the third indication information indicates that the EAP identity request message is used for used by the second terminal;
  • the authentication command response message includes fourth indication information and an EAP identification response message; the fourth indication information indicates that the EAP identification response message and the second Terminal association.
  • the processor 1303 may also be configured to invoke program instructions in the memory 1301 to control the transceiver 1302 to perform the following steps:
  • the authentication result message includes the authentication result of the target network slice requested by the second terminal;
  • An embodiment of the present application further provides a terminal.
  • the terminal provided by the embodiment of the present application may include a memory 1401 , a transceiver 1402 , a processor 1403 , and a bus system 1404 .
  • the memory 1401 is used to store programs and instructions
  • the transceiver 1402 is used to receive or transmit information under the control of the processor 1403;
  • the processor 1403 is used for executing the program in the memory 1401;
  • the bus system 1401 is used to connect the memory 1401, the transceiver 1402 and the processor 1403, so that the memory 1401, the transceiver 1402 and the processor 1403 communicate;
  • the processor 1403 is configured to call program instructions in the memory 1401, and control the transceiver 1402 to perform the following steps:
  • the first authentication message includes first indication information and a first extensible authentication protocol EAP message; the first indication information indicates that the first EAP message uses to be used by the second terminal; the first EAP message is used to verify the legitimacy of the target network slice requested by the second terminal to be used;
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • An authentication request message is sent to the first network device; the authentication request message is used to trigger an authentication process for the second terminal that requests to use the target network slice.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the second EAP message is used to verify the legitimacy of the second terminal using the target network slice;
  • the second authentication message includes second indication information and a second EAP message; the second indication information indicates that the second EAP message is associated with the second terminal.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the authentication command includes an EAP identification request message and third indication information; the third indication information indicates that the EAP identification request message is used by the second terminal use;
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the authentication command response message includes fourth indication information and the EAP identification response message; the fourth indication information indicates that the EAP identification response message is the same as the The second terminal is associated.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the authentication result message includes the authentication result of the target network slice requested by the second terminal;
  • the second terminal relays the data in the target network slice.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • a discovery message is sent; the discovery message includes HPLMN identification information of the first terminal.
  • the processor 1403 is further configured to call program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the first EAP message is used to verify the validity of the target network slice requested by the second terminal; the second terminal The terminal accesses the first network device.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • An authentication request message is sent; the authentication request message is used to trigger an authentication process for the second terminal that requests to use the target network slice.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the first authentication, authorization and accounting server AAA-S Send an authentication request message to the first authentication, authorization and accounting server AAA-S through the application layer; the first AAA-S is the home AAA-S of the second terminal.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the second EAP message is used to authenticate the use of the target network slice and validity by the second terminal.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • An EAP identification response message is sent to the first terminal.
  • the processor 1403 is further configured to invoke program instructions in the memory 1401 to control the transceiver 1402 to perform the following steps:
  • the discovery message includes HPLMN identification information of the first terminal
  • processor 1403 is further configured to call the program instructions in the memory 1401 to perform the following steps:
  • the first network device is accessed through the first terminal.
  • the above-mentioned processor may be an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), or a Digital Signal Processing Device (DSPD) ), at least one of a programmable logic device (Progmable Logic Device, PLD), a field programmable gate array (Field Progmable Gate Array, FPGA), a central processing unit (Central Processing Unit, CPU), a controller.
  • ASIC Application Specific Integrated Circuit
  • DSP Digital Signal Processor
  • DSPD Digital Signal Processing Device
  • PLD programmable logic device
  • FPGA field programmable gate array
  • CPU Central Processing Unit
  • the memory can be a volatile memory (volatile memory), such as RAM; or a non-volatile memory (non-volatile memory), such as ROM, flash memory (flash memory), hard disk (Hard Disk Drive, HDD) or solid-state drive (Solid-State Drive, SSD); or a combination of the above-mentioned types of memory, and provide instructions and data to the processor 1101.
  • volatile memory volatile memory
  • non-volatile memory such as ROM, flash memory (flash memory), hard disk (Hard Disk Drive, HDD) or solid-state drive (Solid-State Drive, SSD); or a combination of the above-mentioned types of memory, and provide instructions and data to the processor 1101.
  • Embodiments of the present application further provide a computer storage medium, specifically a computer-readable storage medium.
  • Computer instructions are stored thereon, and when the computer storage medium is a network device or a terminal, when the computer instructions are executed by the processor, any steps of the authentication method for network slicing in the embodiments of the present application are implemented.
  • the above-mentioned computer storage medium/memory can be a read-only memory (Read Only Memory, ROM), a programmable read-only memory (Programmable Read-Only Memory, PROM), an erasable programmable read-only memory (Erasable Programmable Read-Only Memory, EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Random Access Memory (FRAM), Flash Memory, Magnetic Surface Memory, CD-ROM, or CD-ROM (Compact Disc Read-Only Memory, CD-ROM) and other memories; it can also be various terminals including one or any combination of the above memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc. .
  • references throughout the specification to "one embodiment” or “an embodiment” or “an embodiment of the present application” or “previous embodiments” or “some embodiments” mean the target features related to the embodiments, The structure or characteristic is included in at least one embodiment of the present application. Thus, appearances of "in one embodiment” or “in an embodiment” or “the present embodiments” or “the preceding embodiments” or “some embodiments” in various places throughout the specification are not necessarily necessarily referring to the same embodiments . Furthermore, the features, structures or characteristics of these objects may be combined in any suitable manner in one or more embodiments.
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application.
  • implementation constitutes any limitation.
  • the above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.
  • the detection device performs any step in the embodiments of the present application, which may be performed by a processor of the detection device. Unless otherwise specified, the embodiments of the present application do not limit the sequence in which the detection device performs the following steps. In addition, the manner in which data is processed in different embodiments may be the same method or different methods. It should also be noted that, any step in the embodiments of the present application can be independently performed by the detection device, that is, when the detection device performs any step in the foregoing embodiments, it may not depend on the execution of other steps.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms. of.
  • the unit described above as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit; it may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may all be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above integration
  • the unit can be implemented either in the form of hardware or in the form of hardware plus software functional units.
  • the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, the execution includes: The steps of the above method embodiments; and the aforementioned storage medium includes: a removable storage device, a read only memory (Read Only Memory, ROM), a magnetic disk or an optical disk and other media that can store program codes.
  • ROM Read Only Memory
  • the above-mentioned integrated units of the present application are implemented in the form of software function modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.
  • the computer software products are stored in a storage medium and include several instructions to make A computer device (which may be a personal computer, a detection device, or a network device, etc.) executes all or part of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes various media that can store program codes, such as a removable storage device, a ROM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Les modes de réalisation de la présente demande concernent un procédé d'authentification pour une tranche de réseau. Le procédé comprend les étapes suivantes : un premier dispositif réseau envoie un premier message d'authentification à un premier terminal lors de la réception d'un message de demande d'authentification, le message de demande d'authentification servant à déclencher un flux d'authentification pour un second terminal qui demande l'utilisation d'une tranche de réseau cible ; et le second terminal accède au premier dispositif réseau au moyen du premier terminal, le premier message d'authentification comprenant des premières informations d'indication et un premier message de protocole d'authentification extensible, les premières informations d'indication indiquant que le premier message de protocole d'authentification extensible est destiné à être utilisé par le second terminal, et le premier message de protocole d'authentification extensible servant à vérifier la légitimité du second terminal à l'aide de la tranche de réseau cible. Les modes de réalisation de la présente demande concernent également un appareil d'authentification pour une tranche de réseau, ainsi qu'un dispositif et un support de stockage.
PCT/CN2021/087685 2021-04-16 2021-04-16 Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage WO2022217571A1 (fr)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP21936450.2A EP4325916A4 (fr) 2021-04-16 2021-04-16 Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage
PCT/CN2021/087685 WO2022217571A1 (fr) 2021-04-16 2021-04-16 Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage
CN202180096897.0A CN117158012A (zh) 2021-04-16 2021-04-16 网络切片的鉴权方法及装置、设备和存储介质
US18/378,830 US20240056807A1 (en) 2021-04-16 2023-10-11 Network equipment and user equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/087685 WO2022217571A1 (fr) 2021-04-16 2021-04-16 Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/378,830 Continuation US20240056807A1 (en) 2021-04-16 2023-10-11 Network equipment and user equipment

Publications (1)

Publication Number Publication Date
WO2022217571A1 true WO2022217571A1 (fr) 2022-10-20

Family

ID=83640039

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/087685 WO2022217571A1 (fr) 2021-04-16 2021-04-16 Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage

Country Status (4)

Country Link
US (1) US20240056807A1 (fr)
EP (1) EP4325916A4 (fr)
CN (1) CN117158012A (fr)
WO (1) WO2022217571A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109417687A (zh) * 2016-07-01 2019-03-01 金雅拓M2M有限责任公司 用于蜂窝网络中的用户设备的远程供给的方法
CN109699031A (zh) * 2018-01-11 2019-04-30 华为技术有限公司 采用共享密钥、公钥和私钥的验证方法及装置
WO2020035732A1 (fr) * 2018-08-13 2020-02-20 Lenovo (Singapore) Pte. Ltd. Authentification de tranche de réseau
CN112512096A (zh) * 2017-05-09 2021-03-16 华为技术有限公司 一种基于切片的通信方法和设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109417687A (zh) * 2016-07-01 2019-03-01 金雅拓M2M有限责任公司 用于蜂窝网络中的用户设备的远程供给的方法
CN112512096A (zh) * 2017-05-09 2021-03-16 华为技术有限公司 一种基于切片的通信方法和设备
CN109699031A (zh) * 2018-01-11 2019-04-30 华为技术有限公司 采用共享密钥、公钥和私钥的验证方法及装置
WO2020035732A1 (fr) * 2018-08-13 2020-02-20 Lenovo (Singapore) Pte. Ltd. Authentification de tranche de réseau

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CHINA MOBILE, OPPO, HUAWEI, HISILCON: "Remote provisioning of credentials for NSSAA or secondary authentication/authorisation", 3GPP DRAFT; S2-2102263, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. E-Meeting; 20210412 - 20210416, 6 April 2021 (2021-04-06), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051993647 *
See also references of EP4325916A4 *

Also Published As

Publication number Publication date
US20240056807A1 (en) 2024-02-15
CN117158012A (zh) 2023-12-01
EP4325916A4 (fr) 2024-05-29
EP4325916A1 (fr) 2024-02-21

Similar Documents

Publication Publication Date Title
US10743279B2 (en) Network registration and network slice selection system and method
US20220369215A1 (en) Relay selection in cellular sliced networks
US11706705B2 (en) Multimedia priority service
US11533610B2 (en) Key generation method and related apparatus
WO2020224622A1 (fr) Procédé et dispositif de configuration d'informations
EP3860176B1 (fr) Procédé, appareil, et système d'obtention d'informations de capacité de terminal
WO2021136211A1 (fr) Procédé et dispositif pour déterminer un résultat d'autorisation
US20210385283A1 (en) Multimedia Priority Service
WO2019134704A1 (fr) Procédé et appareil de mise à jour de clef
WO2021203891A1 (fr) Procédé, appareil et dispositif de commande d'authentification de tranche de réseau et support de stockage
US20230024999A1 (en) Communication system, method, and apparatus
US20230337002A1 (en) Security context generation method and apparatus, and computer-readable storage medium
WO2019196963A1 (fr) Procédé et dispositif d'accès à une tranche de réseau, support de stockage, et dispositif électronique
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
US20230300702A1 (en) Method, device, and system for core network device re-allocation in wireless network
WO2023087965A1 (fr) Procédé et appareil de communication
WO2022217571A1 (fr) Procédé et appareil d'authentification pour tranche de réseau, et dispositif et support de stockage
US20240129793A1 (en) Network Overload Control
WO2023213181A1 (fr) Procédé et appareil de communication
CN114208240B (zh) 数据传输方法、装置及系统
WO2024066924A1 (fr) Procédé et appareil de configuration de politique de terminal utilisateur, et support et puce
US20230336992A1 (en) Method and apparatus for authenticating user equipment in wireless communication system
US20240179661A1 (en) Deregistration Method and Communication Apparatus
US20240022907A1 (en) Apparatus and method of coordinating a reauthentication/reauthorization procedure for access to uncrewed aerial services
CN117083890A (zh) 协调接入无人航空服务的注册过程的装置和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21936450

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2021936450

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021936450

Country of ref document: EP

Effective date: 20231116